Intel® Celeron® Processor 400Δ Series Specification Update — Supporting the Intel® Celeron® processor 420Δ, 430Δ, and 440Δ August 2008 Notice: The Celeron processor 400 series may contain design defects or errors known as errata which may cause the product to deviate from published specifications. Current characterized errata are documented in this Specification Update.
INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL® PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT.
Contents Preface ...............................................................................................................................5 Summary Tables of Changes ..................................................................................................7 General Information............................................................................................................14 Identification Information ...................................................................................
Revision History Revision Number Description -001 • Initial revision -002 • Added Erratum AM89 to AM92 Date June 2007 October 2007 • Updated Erratum AM13, AM22, AM23 • Added Specification Clarification AM1 -003 • Added Erratum AM93 to AM101 November 2007 • Modified/Updated AM85 -004 • Modified/Updated AM8 December 2007 • Added AM102, AM103 -005 • Added Erratum AM104 January 2008 -006 • Modified/Updates AM42, AM44 August 2008 • Added Erratum AM105 § 4 Specification Update
Preface Preface This document is an update to the specifications contained in the documents listed in the following Affected Documents/Related Documents table. It is a compilation of device and document errata and specification clarifications and changes, and is intended for hardware system manufacturers and for software developers of applications, operating system, and tools.
Preface Nomenclature Errata are design defects or errors. Errata may cause the Intel® Celeron® processor 400 series’s behavior to deviate from published specifications. Hardware and software designed to be used with any given stepping must assume that all errata documented for that stepping are present on all devices. QDF Number – A several digit code used to distinguish between engineering samples. These processors are used for qualification and early design validation.
Summary Tables of Changes Summary Tables of Changes The following table indicates the Specification Changes, Errata, Specification Clarifications or Documentation Changes, which apply to the listed steppings. Intel intends to fix some of the errata in a future stepping of the component, and to account for the other outstanding issues through documentation or Specification Changes as noted.
Summary Tables of Changes Item Numbering Each Specification Update item is prefixed with a capital letter to distinguish the product. The key below details the letters that are used in Intel’s microprocessor specification updates: A= C= D= E= AE = AF = AG = Dual-Core Intel® Xeon® processor 7000 sequence Intel® Celeron® processor Dual-Core Intel® Xeon® processor 2.
Summary Tables of Changes AJ = AK = AL = AM = AN = AO = AP = AR = AS = AT = AV = Quad-Core Intel® Xeon® processor 5300 series Intel® Core™2 Extreme quad-core processor QX6000 series and Intel® Core™2 Quad processor Q6000 series Dual-Core Intel® Xeon® processor 7100 series Intel® Celeron® processor 400 series Intel® Pentium® dual-core processor Quad-Core Intel® Xeon® processor 3200 series Dual-Core Intel® Xeon® processor 3000 series Intel® Celeron® processor 500 series Intel® Xeon® processor 7200, 7300 ser
Summary Tables of Changes NO A1 Plan ERRATA AM14 X No Fix Performance Monitoring Events for Retired Instructions (C0H) May Not be Accurate AM15 X No Fix Performance Monitoring Event For Number Of Reference Cycles When The Processor Is Not Halted (3CH) Does Not Count According To The Specification AM16 X No Fix Using 2M/4M Pages When A20M# Is Asserted May Result in Incorrect Address Translations AM17 X No Fix Code Segment limit violation may occur on 4 Gigabyte limit check AM18 X Plan
Summary Tables of Changes NO A1 Plan ERRATA AM38 X Plan Fix Upper 32 Bits of the FPU Data (Operand) Pointer in the FXSAVE Memory Image May Be Unexpectedly All 1's after FXSAVE AM39 X Plan Fix Performance Monitor IDLE_DURING_DIV (18h) Count May Not be Accurate AM40 X No Fix Values for LBR/BTS/BTM will be Incorrect after an Exit from SMM AM41 X Plan Fix SYSCALL Immediately after Changing EFLAGS.TF May Not Behave According to the New EFLAGS.
Summary Tables of Changes NO A1 Plan ERRATA AM65 X No Fix Performance Monitor SSE Retired Instructions May Return Incorrect Values AM66 X Plan Fix REP Store Instructions in a Specific Situation may cause the Processor to Hang AM67 X Plan Fix Debug Register May Contain Incorrect Information on a MOVSS or POPSS Instruction Followed by SYSRET AM68 X No Fix VM Bit is Cleared on Second Fault Handled by Task Switch from Virtual-8086 (VM86) AM69 X No Fix The BS Flag in DR6 May be Set for No
Summary Tables of Changes NO AM91 AM92 AM93 AM94 A1 Plan X No Fix X Plan Fix X No Fix CPUID Incorrectly Reports Support for C2/C2E on Some Processors X No Fix PMI While LBR Freeze Enabled May Result in Old/Out-of-date LBR Information X No Fix A Memory Access May Get a Wrong Memory Type Following a #GP due to WRMSR to an MTRR Mask X No Fix Performance Monitoring Event FP_MMX_TRANS_TO_MMX May Not Count Some Transitions X No Fix A WB Store Following a REP STOS/MOVS May Lead to Memory-Orde
General Information General Information Figure 1.
Identification Information Identification Information Component Identification The Celeron Processor 400 series can be identified by the following values: Family1 Model2 00000110b 00010110b NOTES: 1.
Errata Errata AM1 Writing the Local Vector Table (LVT) when an Interrupt is Pending May Cause an Unexpected Interrupt Problem: If a local interrupt is pending when the LVT entry is written, an interrupt may be taken on the new interrupt vector even if the mask bit is set. Implication: An interrupt may immediately be generated with the new vector when a LVT entry is written, even if the new LVT entry has the mask bit set.
Errata AM4 VERW/VERR/LSL/LAR Instructions May Unexpectedly Update the Last Exception Record (LER) MSRa Problem: The LER MSR may be unexpectedly updated, if the resultant value of the Zero Flag (ZF) is zero after executing the following instructions Implication: 1. VERR (ZF=0 indicates unsuccessful segment read verification) 2. VERW (ZF=0 indicates unsuccessful segment write verification) 3. LAR (ZF=0 indicates unsuccessful access rights load) 4.
Errata AM7 General Protection Fault (#GP) for Instructions Greater than 15 Bytes May be Preempted Problem: When the processor encounters an instruction that is greater than 15 bytes in length, a #GP is signaled when the instruction is decoded. Under some circumstances, the #GP fault may be preempted by another lower priority fault (e.g. Page Fault (#PF)). However, if the preempting lower priority faults are resolved by the operating system and the instruction retried, a #GP fault will occur.
Errata AM10 A Write to an APIC Register Sometimes May Appear to Have Not Occurred Problem: With respect to the retirement of instructions, stores to the uncacheable memorybased APIC register space are handled in a non-synchronized way. For example if an instruction that masks the interrupt flag, e.g.
Errata AM13 LER MSRs May be Incorrectly Updated Problem: The LER (Last Exception Record) MSRs, MSR_LER_FROM_LIP (1DDH) and MSR_LER_TO_LIP (1DEH) may contain incorrect values after any of the following: • Either STPCLK#, NMI (NonMaskable Interrupt) or external interrupts • CMP or TEST instructions with an uncacheable memory operand followed by a conditional jump • STI/POP SS/MOV SS instructions followed by CMP or TEST instructions and then by a conditional jump Implication: When the conditions for this
Errata AM15 Performance Monitoring Event For Number Of Reference Cycles When The Processor Is Not Halted (3CH) Does Not Count According To The Specification Problem: The CPU_CLK_UNHALTED performance monitor with mask 1 counts bus clock cycles instead of counting the core clock cycles at the maximum possible ratio. The maximum possible ratio is computed by dividing the maximum possible core frequency by the bus frequency.
Errata AM18 FP Inexact-Result Exception Flag May Not Be Set Problem: When the result of a floating-point operation is not exactly representable in the destination format (1/3 in binary form, for example), an inexact-result (precision) exception occurs. When this occurs, the PE bit (bit 5 of the FPU status word) is normally set by the processor. Under certain rare conditions, this bit may not be set when this rounding occurs.
Errata AM19 Global Pages in the Data Translation Look-Aside Buffer (DTLB) May Not Be Flushed by RSM instruction before Restoring the Architectural State from SMRAM Problem: The Resume from System Management Mode (RSM) instruction does not flush global pages from the Data Translation Look-Aside Buffer (DTLB) prior to reloading the saved architectural state.
Errata AM21 The PECI Controller Resets to the Idle State Problem: After reset, the Platform Environment Control Interface (PECI) client controller should first identify a PECI bus idle condition and only then search for the first rising edge. Due to this erratum, the processor PECI controller resets into the “Idle Detected” state upon processor reset.
Errata AM23 Premature Execution of a Load Operation Prior to Exception Handler Invocation Problem: If any of the below circumstances occur, it is possible that the load portion of the instruction will have executed before the exception handler is entered. • If an instruction that performs a memory load causes a code segment limit violation. • If a waiting X87 floating-point (FP) instruction or MMX™ technology (MMX) instruction that performs a memory load has a floating-point exception pending.
Errata AM25 EIP May be Incorrect after Shutdown in IA-32e Mode Problem: When the processor is going into shutdown state the upper 32 bits of the instruction pointer may be incorrect. This may be observed if the processor is taken out of shutdown state by NMI#. Implication: A processor that has been taken out of the shutdown state may have an incorrect EIP. The only software which would be affected is diagnostic software that relies on a valid EIP. Workaround: None identified.
Errata AM28 Performance Monitoring Events for Retired Loads (CBH) and Instructions Retired (C0H) May Not Be Accurate Problem: The following events may be counted as instructions that contain a load by the MEM_LOAD_RETIRED performance monitor events and may be counted as loads by the INST_RETIRED (mask 01H) performance monitor event: • Prefetch instructions • x87 exceptions on FST* and FBSTP instructions • Breakpoint matches on loads, stores, and I/O instructions • Stores which update the A and D bits •
Errata AM30 Unsynchronized Cross-Modifying Code Operations Can Cause Unexpected Instruction Execution Results Problem: The act of one processor, or system bus master, writing data into a currently executing code segment of a second processor with the intent of having the second processor execute that data as code is called cross-modifying code (XMC). XMC that does not force the second processor to execute a synchronizing instruction, prior to execution of the new code, is called unsynchronized XMC.
Errata AM32 Incorrect Address Computed For Last Byte of FXSAVE/FXRSTOR Image Leads to Partial Memory Update Problem: A partial memory state save of the 512-byte FXSAVE image or a partial memory state restore of the FXRSTOR image may occur if a memory address exceeds the 64KB limit while the processor is operating in 16-bit mode or if a memory address exceeds the 4GB limit while the processor is operating in 32-bit mode.
Errata AM35 FXSAVE/FXRSTOR Instructions which Store to the End of the Segment and Cause a Wrap to a Misaligned Base Address (Alignment <= 0x10h) May Cause FPU Instruction or Operand Pointer Corruption Problem: If a FXSAVE/FXRSTOR instruction stores to the end of the segment causing a wrap to a misaligned base address (alignment <= 0x10h), and one of the following conditions is satisfied: 1. 32-bit addressing, obtained by using address-size override, when in 64-bit mode. 2.
Errata AM37 PREFETCHh Instructions May Not be Executed when Alignment Check (AC) is Enabled Problem: PREFETCHT0, PREFETCHT1, PREFETCHT2 and PREFETCHNTA instructions may not be executed when Alignment Check is enabled. Implication: PREFETCHh instructions may not perform the data prefetch if Alignment Check is enabled. Workaround: Clear the AC flag (bit 18) in the EFLAGS register and/or the AM bit (bit 18) of Control Register CR0 to disable alignment checking.
Errata AM40 Values for LBR/BTS/BTM will be Incorrect after an Exit from SMM Problem: After a return from SMM (System Management Mode), the CPU will incorrectly update the LBR (Last Branch Record) and the BTS (Branch Trace Store), hence rendering their data invalid. The corresponding data if sent out as a BTM on the system bus will also be incorrect. Note: This issue would only occur when one of the 3 above mentioned debug facilities are used.
Errata AM43 IA32_FMASK is Reset during an INIT Problem: IA32_FMASK MSR (0xC0000084) is reset during INIT. Implication: If an INIT takes place after IA32_FMASK is programmed, the processor will overwrite the value back to the default value. Workaround: Operating system software should initialize IA32_FMASK after INIT. Status: For the steppings affected, see the Summary Tables of Changes.
Errata AM46 IO_SMI Indication in SMRAM State Save Area May Be Set Incorrectly Problem: The IO_SMI bit in SMRAM's location 7FA4H is set to "1" by the CPU to indicate a System Management Interrupt (SMI) occurred as the result of executing an instruction that reads from an I/O port. Due to this erratum, the IO_SMI bit may be incorrectly set by: • A non-I/O instruction. • SMI is pending while a lower priority event interrupts. • A REP I/O read. • An I/O read that redirects to MWAIT.
Errata AM49 BTS Message May Be Lost When the STPCLK# Signal is Active. Problem: STPCLK# is asserted to enable the processor to enter a low-power state. Under some circumstances, when STPCLK# becomes active, the BTS (Branch Trace Store) message may be either lost and not written or written with corrupted branch address to the Debug Store area. Implication: BTS messages may be lost or be corrupted in the presence of STPCLK# assertions. Workaround: None Identified.
Errata AM52 MOV To/From Debug Registers Causes Debug Exception Problem: When in V86 mode, if a MOV instruction is executed to/from a debug register, a general-protection exception (#GP) should be generated. However, in the case when the general detect enable flag (GD) bit is set, the observed behavior is that a debug exception (#DB) is generated instead. Implication: With debug-register protection enabled (i.e.
Errata AM55 Returning to Real Mode from SMM with EFLAGS.VM Set May Result in Unpredictable System Behavior Problem: Returning back from SMM mode into real mode while EFLAGS.VM is set in SMRAM may result in unpredictable system behavior. Implication: If SMM software changes the values of the EFLAGS.VM in SMRAM, it may result in unpredictable system behavior. Intel has not observed this behavior in commercially available software. Workaround: SMM software should not change the value of EFLAGS.
Errata AM58 CPL-Qualified BTS May Report Incorrect Branch-From Instruction Address Problem: CPL (Current Privilege Level)-qualified BTS (Branch Trace Store) may report incorrect branch-from instruction address under the following conditions: • Either BTS_OFF_OS [9] or BTS_OFF_USR [10] is selected in IA32_DEBUGCTLC MSR (1D9H). • Privilege-level transitions occur between CPL > 0 and CPL 0 or vice versa.
Errata AM61 PEBS Buffer Overflow Status Will Not be Indicated Unless IA32_DEBUGCTL[12] is Set Problem: IA32_PERF_GLOBAL_STATUS MSR (38EH) bit [62] when set, indicates that a PEBS (Precise Event-Based Sampling) overflow has occurred and a PMI (Performance Monitor Interrupt) has been sent. Due to this erratum, this bit will not be set unless IA32_DEBUGCTL MSR (1D9H) bit [12] (which stops all Performance Monitor Counters upon a PMI) is also set.
Errata AM64 BTM/BTS Branch-From Instruction Address May be Incorrect for Software Interrupts Problem: When BTM (Branch Trace Message) or BTS (Branch Trace Store) is enabled, a software interrupt may result in the overwriting of BTM/BTS branch-from instruction address by the LBR (Last Branch Record) branch-from instruction address. Implication: A BTM/BTS branch-from instruction address may get corrupted for software interrupts. Workaround: None identified.
Errata AM67 Debug Register May Contain Incorrect Information on a MOVSS or POPSS Instruction Followed by SYSRET Problem: In IA-32e mode, if a MOVSS or POPSS instruction with a debug breakpoint is followed by the SYSRET instruction, incorrect information may exist in the Debug Status Register (DR6). Implication: When debugging or when developing debuggers, this behavior should be noted. This erratum will not occur under normal usage of the MOVSS or POPSS instructions (i.e.
Errata AM70 Performance Monitoring Events for L1 and L2 Miss May Not be Accurate Problem: Performance monitoring events 0CBh with an event mask value of 02h or 08h (MEM_LOAD_RETIRED.L1_LINE_MISS or MEM_LOAD_RETIRED.L2_LINE_MISS) may under count the cache miss events.
Errata AM73 Update of Attribute Bits on Page Directories without Immediate TLB Shootdown May Cause Unexpected Processor Behavior Problem: Updating a page directory entry (or page map level 4 table entry or page directory pointer table entry in IA-32e mode) by changing Read/Write (R/W) or User/Supervisor (U/S) or Present (P) bits without immediate TLB shootdown (as described by the 4 step procedure in "Propagation of Page Table and Page Directory Entry Changes to Multiple Processors" In volume 3A of the
Errata AM76 Performance Monitoring Counter MACRO_INSTS.DECODED May Not Count Some Decoded Instructions Problem: MACRO_INSTS.DECODED performance monitoring counter (Event 0AAH, Umask 01H) counts the number of macro instructions decoded, but not necessarily retired.
Errata AM78 Writing Shared Unaligned Data that Crosses a Cache Line without Proper Semaphores or Barriers May Expose a Memory Ordering Issue Problem: Software which is written so that multiple agents can modify the same shared unaligned memory location at the same time may experience a memory ordering issue if multiple loads access this shared data shortly thereafter. Exposure to this problem requires the use of a data write which spans a cache line boundary.
Errata AM80 Fault on ENTER Instruction May Result in Unexpected Values on Stack Frame Problem: The ENTER instruction is used to create a procedure stack frame. Due to this erratum, if execution of the ENTER instruction results in a fault, the dynamic storage area of the resultant stack frame may contain unexpected values (i.e. residual stack data as a result of processing the fault). Implication: Data in the created stack frame may be altered following a fault on the ENTER instruction.
Errata AM82 Page Access Bit May be Set Prior to Signaling a Code Segment Limit Fault Problem: If code segment limit is set close to the end of a code page, then due to this erratum the memory page Access bit (A bit) may be set for the subsequent page prior to general protection fault on code segment limit. Implication: When this erratum occurs, a non-accessed page which is present in memory and follows a page that contains the code segment limit may be tagged as accessed.
Errata AM85 ODLAT Does Not Match on Written Data When the FSB Ratio is 6:1 Problem: Normally, the ODLAT (On-Die Logic Analyzer) debug mechanism triggers when an FSB (Front Side Bus) transaction that matches the ODLAT_ARM MSRs completes. When a trigger occurs, one of the BPMx# pins is driven for 1 FSB clock cycle. Due to this erratum, when the FSB ratio is 6:1 and ODLAT is programmed to match data it will not trigger on write transactions.
Errata AM88 Updating Code Page Directory Attributes without TLB Invalidation May Result in Improper Handling of Code #PF Problem: Code #PF (Page Fault exception) is normally handled in lower priority order relative to both code #DB (Debug Exception) and code Segment Limit Violation #GP (General Protection Fault).
Errata AM90 Performance Monitoring Event MISALIGN_MEM_REF May Over Count Problem: Performance monitoring event MISALIGN_MEM_REF (05H) is used to count the number of memory accesses that cross an 8-byte boundary and are blocked until retirement. Due to this erratum, the performance monitoring event MISALIGN_MEM_REF also counts other memory accesses. Implication: The performance monitoring event MISALIGN_MEM_REF may over count.
Errata AM93. CPUID Incorrectly Reports Support for C2/C2E on Some Processors Problem: CPUID.05H:EDX [bits 11-8] incorrectly reports support for C2/C2E C-state in the number of C2 Sub C-states. A value of 02H is reported, where the correct value is 00H. The affected processors are identified by the following CPUID Brand Strings: • Intel(R) Celeron(R) CPU 420 @ 1.60GHz • Intel(R) Celeron(R) CPU 430 @ 1.80GHz • Intel(R) Celeron(R) CPU 440 @ 2.
Errata AM95. A Memory Access May Get a Wrong Memory Type Following a #GP due to WRMSR to an MTRR Mask Problem: The TLB (Translation Lookaside Buffer) may indicate a wrong memory type on a memory access to a large page (2M/4M Byte) following the recovery from a #GP (General Protection Fault) due to a WRMSR to one of the IA32_MTRR_PHYSMASKn MSRs with reserved bits set. Implication: When this erratum occurs, a memory access may get an incorrect memory type leading to unexpected system operation.
Errata AM97. A WB Store Following a REP STOS/MOVS May Lead to Memory-Ordering Violations Problem: Under certain conditions, as described in the Software Developers Manual section “Out-of-Order Stores For String Operations in Pentium 4, Intel Xeon, and P6 Family Processors”, the processor performs REP MOVS or REP STOS as fast strings. Due to this erratum, stores of WB memory type to a cache line previously written by a preceding fast string instruction may be observed before a string store.
Errata AM98. Use of Memory Aliasing with Inconsistent Memory Type may Cause a System Hang or a Machine Check Exception Problem: Software that implements memory aliasing by having more than one linear addresses mapped to the same physical page with different cache types may cause the system to hang or to report a machine check exception (MCE). This would occur if one of the addresses is non-cacheable and used in a code segment and the other is a cacheable address.
Errata AM100. RSM Instruction Execution under Certain Conditions May Cause Processor Hand or Unexpected Instruction Execution Results Problem: RSM instruction execution, under certain conditions triggered by a complex sequence of internal processor micro-architectural events, may lead to processor hang, or unexpected instruction execution results.
Errata AM104 Benign Exception after a Double Fault May Not Cause a Triple Fault Shutdown Status: According to the Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A, “Exception and Interrupt Reference”, if another exception occurs while attempting to call the double-fault handler, the processor enters shutdown mode. However due to this erratum, only Contributory Exceptions and Page Faults will cause a triple fault shutdown, whereas a benign exception may not.
Specification Changes Specification Changes The Specification Changes listed in this section apply to the following documents: • Intel® Celeron® Processor 400 Series Datasheet • Intel® 64 and IA-32 Architectures Software Developer’s Manual volumes 1,2A, 2B, 3A, and 3B All Specification Changes will be incorporated into a future version of the appropriate Intel® Celeron® processor 400 series documentation. Δ Intel processor numbers are not a measure of performance.
Specification Clarifications Specification Clarifications The Specification Clarifications listed in this section apply to the following documents: • Intel® Celeron® Processor 400 Series Datasheet • Intel® 64 and IA-32 Architectures Software Developer’s Manual volumes 1,2A, 2B, 3A, and 3B All Specification Clarifications will be incorporated into a future version of the appropriate Intel® Celeron® processor 400 series documentation. AM1.
Documentation Changes Documentation Changes The Documentation Changes listed in this section apply to the following documents: • Intel® Celeron® Processor 400 Series Datasheet All Documentation Changes will be incorporated into a future version of the appropriate Intel® Core™2 Extreme and Intel® Core™2 Duo Desktop Processor documentation.
